13 hours after PHP patch, 235 of top 20,000 sites can never get the fix

Thirteen hours after PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical unauthenticated RCE bugs (CVE-2026-109618 and CVE-2026-109619, dubbed PHP2Shell), a scan of the Tranco top 20,000 found that of 428 sites exposing their PHP version, only 107 run a patched release and 235 run end-of-life branches.

• Of 428 sites exposing a PHP version, only 107 (25%) run a patched release
• 235 sites (55%) run PHP 8.1 or older and will never receive the fix
• 68 sites still serve PHP 7.4; one answers on PHP 4.4
• The bugs allow unauthenticated code execution and can leak worker memory